No qubes.UpdatesProxy after upgrading to Qubes 4.2

User Support
1

Hi,
I have reviewed several threads regarding the qubes.UpdatesProxy. This file appears to belong to versions before 4.2. I recently installed 4.2. The problem is that the whonix* templates update fine, but the debian-12/fedora-38 templates can’t connect to the 127.0.0.1:8082 proxy.

In 4.2, I found the updatesProxy commands at /etc/qubes/policy.d/*
When running:
grep -i 'templateVM' ./*
/90-default.policy:# Upgrade all TemplateVMs through sys-whonix.
/90-default.policy:#qubes.UpdatesProxy * @type:TemplateVM @default allow target=sys-whonix
./90-default.policy:# Upgrade Whonix TemplateVMs through sys-whonix.
./90-default.policy:# Deny Whonix TemplateVMs using UpdatesProxy of any other VM.
./90-default.policy:# Default rule for all TemplateVMs - direct the connection to sys-net
./90-default.policy:qubes.UpdatesProxy * @type:TemplateVM @default allow target=sys-net

Here is the entire excerpt from the 90-default.policy file:
# HTTP proxy for downloading updates
# Upgrade all TemplateVMs through sys-whonix.
#qubes.UpdatesProxy * @type:TemplateVM @default allow target=sys-whonix
# Upgrade Whonix TemplateVMs through sys-whonix.
qubes.UpdatesProxy * @tag:whonix-updatevm @default allow target=sys-whonix
# Deny Whonix TemplateVMs using UpdatesProxy of any other VM.
qubes.UpdatesProxy * @tag:whonix-updatevm @anyvm deny
# Default rule for all TemplateVMs - direct the connection to sys-net
qubes.UpdatesProxy * @type:TemplateVM @default allow target=sys-net
qubes.UpdatesProxy * @anyvm @anyvm deny

So sys-net is enabled for templateVMs - but they don’t get updated.
I get this error message:
Error: Failed to download metadata for repo 'fedora': Cannot prepare internal mirrorlist: Curl error (28): Timeout was reached for https://mirrors.fedoraproject.org/metalink?repo=fedora-38&arch=x86_64 [Proxy CONNECT aborted due to timeout]

Besides this file, do I have to change anything else. In the debian/fedora settings, the Net Qube is set to default(none).
I also set the setting in the policy file to sys-whonix instead of sys-net. But it doesn’t appear to work.

Thanks
flc

2

So sys-whonix does work for updating my fedora-38-xfce template. Will try the Debian-12 after this finishes successfully.

In the sys-whonix, the net qube is sys-firewall.

3

I was able to update all VMs using sys-whonix. So the initial problem is gone.
Can anyone confirm that qubes.UpdatesProxy file is really gone from 4.2
I viewed the /etc/qubes-rpc/ folder. There are many qubes.* file but no qubes.UpdatesProxy file.

Btw, I have been viewing/editing the files in dom0.

4

I confirm.

5

I have the same problem after upgrading to 4.2, but explicitly do not want to use sys-whonix as an update proxy for fedora/debian VMs, but the default, which is sys-net, which doesn’t work, as described by the original poster. How do I get it working again?

6

What’s your sys-net template?
What’s the output of this command in dom0?

cat /etc/qubes/policy.d/* | grep UpdatesProxy

Try to set sys-net as “Default update proxy” in Qubes Global Config → Updates tab.
If “Default update proxy” is already set to sys-net then set it to some other qube, press Apply button and change to sys-net again and press Apply.

7

I think the proxy is set correctly.

I want to add that stage 4 of the upgrade fails because of this error.

/etc/qubes/policy.d/50-config-updates.policy:5:qubes.UpdatesProxy    *    @tag:whonix-updatevm    @default    allow target=sys-whonix
/etc/qubes/policy.d/50-config-updates.policy:6:qubes.UpdatesProxy    *    @type:TemplateVM    @default    allow target=sys-net
/etc/qubes/policy.d/90-default.policy:68:#qubes.UpdatesProxy     *    @type:TemplateVM        @default    allow target=sys-whonix
/etc/qubes/policy.d/90-default.policy:70:qubes.UpdatesProxy      *   @tag:whonix-updatevm    @default    allow target=sys-whonix
/etc/qubes/policy.d/90-default.policy:71:# Deny Whonix TemplateVMs using UpdatesProxy of any other VM.
/etc/qubes/policy.d/90-default.policy:72:qubes.UpdatesProxy      *   @tag:whonix-updatevm    @anyvm      deny
/etc/qubes/policy.d/90-default.policy:74:qubes.UpdatesProxy      *   @type:TemplateVM        @default    allow target=sys-net
/etc/qubes/policy.d/90-default.policy:75:qubes.UpdatesProxy      *   @anyvm                  @anyvm      deny
8

What’s the output of this command in dom0?

qvm-features sys-net

Check if qubes-updates-proxy service is there:

service.qubes-updates-proxy  1
9

it’s present.

10

Run this command in debian/fedora template:

curl --proxy http://127.0.0.1:8082/ https://1.1.1.1

Post the error if it’ll give you one.

Also check the qubes-updates-proxy service status in sys-net:

sudo systemctl status qubes-updates-proxy.service
1 Like
11

The qubes-updates-proxy service on sys-net was in a failed state. Restarting it fixed the problem.
Thank you, very much!

However know I might have to investigate why it failed, if it keeps failing…